so i need to combine the parent data with the child data to form a complete record.
I have successfully managed to process all children of the first parent and access the parent data but cant figure out a way of breaking up the document twice or referring to the parent element when processing a child.
in general i am trying to see if logstash is flexible enough to deal with ad heterogenous xml docs (differetn structure from different clients) - im thinking currently that it isnt and that im better processing them first and producing a standard output for logstash to ingest.
You can then re-arrange the fields as you want them.
If you really want to transform one XML document that has parents with nested children into an XML document that has a list of children with a parent attribute I don't think logstash is the tool you want. Maybe XLST?
Useful but no. it was just the flattening capability i was looking for. That was just an example of how the xml feed could have come in and not be nested i.e. more simple to deal with from what id seen from other examples. We will probably want to index into Elastic Search.